26b513500190eb8a8ff87c93edefd540e7820c562ff89a5f2c810de2dde60619

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
899s
max time network
885s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 288KB
Sample260804-mg8smsxgmc
SHA256 26b513500190eb8a8ff87c93edefd540e7820c562ff89a5f2c810de2dde60619
MD5 0ccb346e1b5833ae8a189ad8395eaff7
SHA1 7d5fd29e3ea9dc0ab35ba595b056c6416ec6b461
SHA512 d7e943889008dbd5f3b808ab35bb9a79387dd2b02e813335f8c66bac2b5d2d35589b46a06e2bfc5d1f3bbd8ad378c41ea3276b36457f292ea2a43b2fe1e92751
SSDEEP 3072:weoZyyzqCQrbI7fORcXlpyrH5TjQbildxRIVWXFhy5+qi:weoZyyzqCQHI7fpyrH5QW5RIqFqi
TLSH
T1C0544B726300743BE423DEA1A7BE6E0E3C25F22BDC0A46F86595E530DFE2EB2151525D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1940	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303128904511282"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe
Token: SeShutdownPrivilege	5416	chrome.exe
Token: SeCreatePagefilePrivilege	5416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe
5416	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 5156	5416	chrome.exe	88
PID 5416 wrote to memory of 1940	5416	chrome.exe	90
PID 5416 wrote to memory of 2544	5416	chrome.exe	93
PID 5416 wrote to memory of 2544	5416	chrome.exe	93
PID 5416 wrote to memory of 5860	5416	chrome.exe	91
PID 5416 wrote to memory of 5860	5416	chrome.exe	91
PID 5416 wrote to memory of 4492	5416	chrome.exe	94
PID 5416 wrote to memory of 4492	5416	chrome.exe	94
PID 5416 wrote to memory of 5892	5416	chrome.exe	95
PID 5416 wrote to memory of 5892	5416	chrome.exe	95
PID 5416 wrote to memory of 2152	5416	chrome.exe	96
PID 5416 wrote to memory of 4516	5416	chrome.exe	98
PID 5416 wrote to memory of 888	5416	chrome.exe	99
PID 5416 wrote to memory of 4516	5416	chrome.exe	98
PID 5416 wrote to memory of 888	5416	chrome.exe	99
PID 5416 wrote to memory of 5776	5416	chrome.exe	102
PID 5416 wrote to memory of 5776	5416	chrome.exe	102
PID 5416 wrote to memory of 5788	5416	chrome.exe	103
PID 5416 wrote to memory of 5788	5416	chrome.exe	103
PID 5416 wrote to memory of 4068	5416	chrome.exe	104
PID 5416 wrote to memory of 4068	5416	chrome.exe	104
PID 5416 wrote to memory of 5836	5416	chrome.exe	105
PID 5416 wrote to memory of 5836	5416	chrome.exe	105
PID 5416 wrote to memory of 4352	5416	chrome.exe	106
PID 5416 wrote to memory of 4352	5416	chrome.exe	106
PID 5416 wrote to memory of 1356	5416	chrome.exe	107
PID 5416 wrote to memory of 1356	5416	chrome.exe	107
PID 5416 wrote to memory of 796	5416	chrome.exe	109
PID 5416 wrote to memory of 1876	5416	chrome.exe	110
PID 5416 wrote to memory of 5672	5416	chrome.exe	111
PID 5416 wrote to memory of 4796	5416	chrome.exe	112
PID 5416 wrote to memory of 4312	5416	chrome.exe	113
PID 5416 wrote to memory of 4312	5416	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff80c75c728,0x7ff80c75c734,0x7ff80c75c740
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,9620797580472698809,775283532930208489,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,5566751585887987250,14959028859105434543,262144 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,5353391624159265019,13237554325450414629,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:13
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,3233414953689546974,13313607100275806532,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,6819150444723458034,7638540294573074134,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,1787065046642222085,3329337537353976753,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5568,i,10746480958836612619,15880551443480737440,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5600,i,3769587982762511868,16533960578280650550,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5852,i,11678591478657014298,6725693583665045219,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5908,i,8291529898781973468,17184965303462072828,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4816,i,12424305830119986607,11833081415429170072,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4812,i,8313918426072679345,5442996626814324183,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5556,i,17803662245787637243,18237903870843096500,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6040,i,14559205877965989146,12672056798781382429,2097152 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,10470486240113213567,9550794716044842675,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,1396438027994629409,5585199726729804298,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,3870718091744560841,7860105478308712611,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3368,i,5658114821719682138,17501355230719263716,262144 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,8765469178205355783,8991400659708548020,524288 --field-trial-handle=1900,i,18019407338309176212,18223642283433479056,262144 --variations-seed-version --mojo-platform-channel-handle=1516 /prefetch:14
  2⤵
  PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

35136fc1-2078-4432-843b-685f1e176252.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\35136fc1-2078-4432-843b-685f1e176252.tmp
Size 523B
SHA256 59d5335a12dd0e7b3778a50207cb4a57239ce48c990b6e163ca35682def761ed
MD5 da0391ad571dc0522e893cf116445fb1
SHA1 bcc98416d04da5b1b1b7c6bbdda92523215d1add
SHA512 ee657de792036afb34ca6334ba901b246ea9e96a7c395eb38b4eb533abcdf5ec3cbf94f8a3d63fb1d978d62bfb09ad61e4f8e95e85502dae88bc32f001a0ac35
TLSH
T126F050B7B77F7453007945BFAD06B80ABDB5A435058068E4CF57426DE0415E71B02453
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 95810125ca0d804945875d5a69c533df0a7499694d2dceddab66195c1d2ba854
MD5 28be4cfdc024bbbf263f1dadec3772af
SHA1 cb044aa07cf699c88b3c10043f0e91267a9488b3
SHA512 a4b40810926a0b0addd14abc38321457c1ccd407c37d808600cf68e0b818cd6c15db4294443f2106615e5a8fa79f0c6d792e0b938fa7e2455bf49441b3c83a40
TLSH
T14F517BF7C7D8867E890152F4EB256E1BCE2D4A19422C3C66C8E4AF5F67E2871D20059F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 314226b746635a46dd76ea0bcf3af94a0150dfd781fe76aecaa5a7caac167607
MD5 803b5f8375d4cb963a0f1004b06bb853
SHA1 e3e8287e35afdb7712ccacd8699db4e8d44196c0
SHA512 488bd47b569cc3eef98f83818c10495a5711dba790c607f4f44dec1c44ade9b2370a023f0fb821729a00476242b4d362a903ac9a807d3ef104aa0a0f138fbeae
TLSH
T1BE517BF7C7D8867E890152F4EB256E1BCE290A19432C3C66C8E4AE5F67E1871D20069F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4b26d1ebcb25885d117bbed8150e0b223e34c3622eb4ecf147fa824e3d34cc1d
MD5 f5fda9913eb9da8e48563c90691b3a65
SHA1 ace3d40d3579edc7df79b9f58926271053cac43f
SHA512 9f4e3f00eb449f6772b91da302a41b646d51f0a08259012d3376ff60d1392511871a57270288be0d731a2f6b143bc0c128bbe50c12d011a57fe31e35cc16dbd9
TLSH
T10A618CF7C7D8867D880156F4EB256E1BCD2D4A19422C3C66C8E4AF5F67E1871D20059F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d70da8a1cac45eba1e5fc459150b45f810bbbd4afa5358acbb60788b3ce1e3bd
MD5 8d4833f8ea10448beaa0a97244b0a1c5
SHA1 451c71e07ba119b5b9bd77dd6a17f86d3d911827
SHA512 110d0aeba79acf964d03b55ea6cf072826bdf8e84aa3cd875ec0b3d4f8e2e67ca19b741eb4995cc4debc28db75fac5aed828526f60ff62b379765aeea85b39b4
TLSH
T179518AF7C3D8867E890152F4EB256E1BCE294A19422C3C66C8E4AF5F67E1871D20059F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3d7811eb99e251def6c85f4827d75ea68bd9cbf80ce888eb5c18f0eca06f743f
MD5 f08457ff11a3a73ea0165b167c6871fc
SHA1 8a79e7ad0687aa362a4df7a2bdd3fbd543a7b8ef
SHA512 ac74d57de1c5e58a55fa71791238f91ed4b2a58de844ac1dbd989af699b17b59a9fff4894e6c348200b582a9a65b143595b54670d5ee620cdc0fdff108848b0d
SSDEEP 192:7R87fy2lLv7KvAPRp2+F9NLHsb+WNnwyZPteeUeVyIsnAUgR:7R87q2lzu6X93w3P/R
TLSH
T10532A72EBA50693B6ECBD61AF9257B53DBF6102121D02E84E7FC9A2C14D76CC7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ec05c0ca3c42a1ede2721ac53705ef199467d5839bb80e2cac62b99c715a9027
MD5 806dd30e4e5ff716b29f2ca4ed8c251f
SHA1 98e6b04f87d525965ff93b9c571f93020a823545
SHA512 5011fb7b2baecf099546f05e3c5795c5fab3686a7d83750a662be4544078260a36a9c62a2a440d83954acfd695614c9e62016c8e5b2930abd7d960278e982d9b
SSDEEP 192:7R87fy2lLv7KviPRpc+F9NLHsb+WNnwyZPDeeU2VyIsnAUgE:7R87q2lzuMX73w3PvE
TLSH
T11142C62EB950693B6ECBD619F9257B53DBF5102120E02E84E7FC9A2C15EB6CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 4edb454ae1cd38e44ab61e8bc7c62d9d108250354b02302f71450669c872d0f6
MD5 13197245b25e9aa86de821102e61d408
SHA1 929a229512317846d7dafdc9dd161bdb8d65bd8b
SHA512 71fee6275d2a6ce90b55cea44707b0e017250b259c44c10deb69b494836d0187457d85b0e99662043251467d0a58e19b3316cf96539d29c3a6c2309fc8bf0602
SSDEEP 768:3zVvIiBl+84mRktwALHBwdHQAnqkoiqhQwr/1LrlxVgCw0+u/TEAo:jC5mRktfLhwdakoxhrxh4Cw0+2TNo
TLSH
T15313E1735C1E586612136227F227B6D389FE017BCD20BB30DEDA1E051346DC883A76A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cf2e7bb0280fe376e711ceb417771b9724049f68b8a3ab0efacf67533c48a154
MD5 919daeaff58b3b1c73cec65cd7722067
SHA1 d329ed666d65131dbe8f508db64b91284e2e36b9
SHA512 90ada4c453ce73770fc0444456aac702d793f8752642af0e5cadbd7a0245bb7b37d64eca336f2f149ccaa8716fab2dad340ded9a1c0f5a53a5d75c76c2249135
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQYztCSl8h4otop5ku6DxB6U3GyvUgIlG1QzbOQ4Efvf0k:ht0qDHUgvIdkiU2k3HfWsIlTL4EfvfUi
TLSH
T16DC12835B86DAD7359B3E51AF4132E83CDBA60AF9A616E64D6CA0F0C11D74DC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0c5b4fc7963f801080daa87b7b57e14c96015628eb9691f154cad97bcd75a6be
MD5 d10f65cee8ffe94bd9b68500356739a6
SHA1 c6bacd39096283e4f66184304b6fe40e5a8cc11e
SHA512 1fa12bf0e95a90987fb22b954da1a6c61f0214ee6d0bf021d0347f5f5eb296717ebb547d7f66419933a57450acb6ae83c107385a72425c768a68e39b445913a8
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5kuqDxB6WGyvUU+vsbL/Mmv4a:BC0qDHUgvIdaDUDk/HCI+vsbL/N
TLSH
T122A11931B46D5D775A76D909F96A2E43CEB9606BEA31BE44D9DE0E0C11E70EC1302613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b28982b6b59a48103048a53455afbd4fd51c5200b7cbf006141398a5114b9927
MD5 f88a6fd6688e7c20db0e2e095cb34a19
SHA1 fe65669f2d5cc59597bad798a9b09c64fe539340
SHA512 faf570445ad7c4806368f0b01dafba4df69941cdf2749d7f6f79f7e972e8e5ffece28b8a525558091ed9b3cfff8043f362a74aad197a9e96defe3a6e05efe477
SSDEEP 96:BC0d+hDK+UyKovbfaNQYztCSl8h4otop5ku6DxB6U3GyvUgIlG1QzbOQQPfvf0jw:BC0qDHUgvIdkiU2k3HfWsIlTLQPfvfUi
TLSH
T1CEC11835B86CAD3359B3A51AF4132E83CDBA20AB9A616E64D6CB0F0C11D74EC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 10279399560dad6e624f952e4a04a305628252953c5cc08134ec090e41d78463
MD5 df48b47d3a60dec848a098d0d8e5cff5
SHA1 84570f389091bda12c22d3cabe98fa2cebdf3c46
SHA512 40b294e0ccd72f45d56dd1e56368b698fbcc1852bb44c16a4aa5f37c0f119a3c5f4729987f7797e6793ecbd471fbcc88cd1f62645d8d05a7292fc67cb673edb7
SSDEEP 96:hbJod+hDK+UyKovbfaNQYztCSl8h4otop5ku6DxB6U3GyvUgYWKfvCRNC39ISyVQ:htoqDHUgvIdkiU2k3HfWsjKfvCuCzc
TLSH
T1E1C10771E46D5C7B5EB6A849B1132D83CDB9206BAA607E28E9EE0E0C01E74DC1383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download